Health Insurance Portability and Accountability Act (HIPPA) Practice Exam

Which of the following is NOT a requirement of the HIPAA Privacy standards?

1. Privacy policies for patients

2. Contracts with covered entities and subcontractors

3. Staff training on PHI

4. Management of disclosures to law enforcement

The correct answer is: Contracts with covered entities and subcontractors

The correct response highlights that contracts with covered entities and subcontractors are not a direct requirement of the HIPAA Privacy standards regarding patient privacy. Instead, these contracts are more closely related to the HIPAA Security Rule and other compliance obligations under HIPAA for entities handling protected health information (PHI). The Privacy Rule primarily mandates that healthcare providers and organizations must implement privacy policies that govern how they manage and protect patient information, ensure staff training on handling PHI to maintain confidentiality, and establish protocols for managing disclosures of PHI, including those to law enforcement. These elements are all integral to ensuring patient privacy rights are upheld according to HIPAA regulations. Understanding these distinctions is vital; the relationship dynamics clarified by contracts pertain to the Security Rule's focus on safeguarding electronic PHI through agreements that outline responsibilities among involved parties, which is essential for compliance but doesn't fall within the core privacy requirements.